wangjia
1a346c32c1
deploy-pangolin / deploy (push) Has been cancelled
- edge: 容器化 nginx 接管 80/443,逐字移植现网 vhost(blog/jiu/marzban/pay)+ stream SNI 分流 - singbox: Hysteria2(host 网络,UDP 443) - certbot: DNS-01(Cloudflare)续期,容器化 - xray: REALITY 仅 profile newnode(本台沿用 Marzban) - deploy.sh 幂等且切换感知;cutover.sh 一次性停宿主 nginx 切容器(可秒级回滚) - 弃用方案A 的 host nginx-apply/sudoers/root-setup - 部署目录改 ~/pangolin(免 root);CI 注入 CF_API_TOKEN EC2 实测:edge nginx -t 通过(真实证书)、compose 校验通过 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
# pangolin 数据/分发面(方案 C)。
|
|
# 与现网 marzban/jiu/billing/blog 并存:edge 反代到它们,其余容器不动。
|
|
# 镜像固定版本(EC2 实测:nginx 1.27 / sing-box 1.13.12 / xray 26.3.27)。
|
|
# project 名由命令行 `-p pangolin` 指定(兼容宿主 docker-compose 版本)。
|
|
|
|
services:
|
|
# 分发层:接管 80/443,移植现网全部路由(host 网络才能绑端口并回连 127.0.0.1 后端)
|
|
edge:
|
|
image: nginx:1.27-alpine
|
|
container_name: pangolin-edge
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
volumes:
|
|
- ./edge/nginx.conf:/etc/nginx/nginx.conf:ro
|
|
- ./edge/stream.conf:/etc/nginx/stream.conf:ro
|
|
- ./edge/conf.d:/etc/nginx/conf.d:ro
|
|
- /etc/letsencrypt:/etc/letsencrypt:ro # 证书(只读)
|
|
- /opt/jiu:/opt/jiu:ro # jiu 静态(images/web/marketing)
|
|
- /var/www/pay:/var/www/pay:ro # 收款页静态
|
|
healthcheck:
|
|
test: ["CMD", "nginx", "-t"]
|
|
interval: 1m
|
|
timeout: 10s
|
|
retries: 3
|
|
|
|
# Hysteria2 加速线(UDP 443)
|
|
singbox:
|
|
image: ghcr.io/sagernet/sing-box:v1.13.12
|
|
container_name: pangolin-singbox
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
volumes:
|
|
- ./singbox/config.json:/etc/sing-box/config.json:ro
|
|
- ./secrets/hy2:/etc/sing-box/cert:ro
|
|
command: ["run", "-c", "/etc/sing-box/config.json"]
|
|
|
|
# 证书续期(DNS-01 / Cloudflare)—— 按需运行:`docker compose run --rm certbot renew`
|
|
# 由宿主 cron 每日调用,renew 后宿主再 `docker exec pangolin-edge nginx -s reload`。
|
|
certbot:
|
|
image: certbot/dns-cloudflare:latest
|
|
container_name: pangolin-certbot
|
|
profiles: ["certbot"]
|
|
volumes:
|
|
- /etc/letsencrypt:/etc/letsencrypt
|
|
- ./secrets/cloudflare.ini:/etc/cloudflare.ini:ro
|
|
entrypoint: ["certbot"]
|
|
|
|
# 新节点用的 REALITY —— 本台不启用(REALITY 仍由 Marzban 提供)
|
|
xray:
|
|
image: ghcr.io/xtls/xray-core:26.3.27
|
|
container_name: pangolin-xray
|
|
profiles: ["newnode"]
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:11443:11443"
|
|
volumes:
|
|
- ./xray/config.json:/etc/xray/config.json:ro
|
|
command: ["run", "-c", "/etc/xray/config.json"]
|